Email Flow Logs – mxHero Help Center

Reports › Email Flow Logs shows every email that passed through mxHERO in the last year: which rules ran, what each rule did, and how the email was finally delivered to each recipient. Use it to confirm that routing and rules work, to answer "where is my email?", and to export logs as CSV.

Before you begin

You need an Owner or Administrator role in the Admin Dashboard.
Email Flow Logs shows email that reaches mxHERO through your mail routing (rules with the Email Flow target). Mailbox rules (User Mailboxes target) report their progress on the rule itself and in Reports › Notifications.
Have at least one of these ready: the sender, a recipient, part of the subject, or the Message-ID, plus the approximate date and time.

What you can search

Period: a rolling window of the last 12 months. You can't search further back.
Delivery status filters that use the final delivery result (Delivered, Delivery attempts exhausted, Returned to sender after delivery, With delivery retries) work only for email from 26 May 2026 onward. Set From Date on or after that date to use them.
New email can take up to a minute to appear.

Search for an email

Open Reports › Email Flow Logs. The Search Logs tab opens.

Fill in one or more filters:

Filter	How it matches
Sender	Envelope sender address; part of the address is enough
Recipient	Recipient address; part of the address is enough
Subject	Part of the subject
Message ID	Part of the Message-ID
From Date, Time	Start of the period (default: 7 days ago, 00:00)
To Date, Time	End of the period (default: today, 23:59)
Delivery status	Outcome of the email (see below). Default Any status.
Has attachments	Only email with one or more attachments

Click Search. The filters panel collapses and the results appear.

The page address keeps your filters. Copy it from the browser to share the same search with a colleague.

Results

Results show Subject, From and Date, newest first. mxHERO fetches 100 results at a time. If there are more, click Get more to load the next 100. Use the rows-per-page control at the bottom of the table to change how many show on each page.

Delivery status filter

Delivery status options in Email Flow Logs

Delivery status	Shows email that…
Any status	matches the other filters
Delivered	was accepted by the recipient's mail server
Delivery attempts exhausted	couldn't be delivered before retries ran out
Dropped by rule action	was intentionally not delivered: blocked by Block Attachments, rejected or canceled in Request Approval or Temporary Hold, or sent to a Forwarding Address
Rejected by organization filter	was refused during processing, for example a recipient rejected before processing or a storage failure on a rule set to Bounce email to sender
Retained Emails	is or was held by Temporary Hold or Request Approval
Returned to sender after delivery	was bounced by the recipient's server after mxHERO handed it over
Returned to sender during processing	was returned to the sender by mxHERO because it couldn't be handed to delivery
With delivery retries	needed more than one delivery attempt
With errors	had a processing error but was still delivered
With rule errors	had a rule that failed (the original email was delivered unchanged)
With storage errors	had a cloud storage error. A second list lets you pick the error type.

With With storage errors, you can narrow down by error type. The list shows only the types that have occurred in your organization.

Storage error type	Meaning
Links sharing errors	Creating a share link failed
Upload to storage errors	Uploading a file to storage failed
Folder collaboration errors	Sharing a folder with the recipients failed
Set mxHERO metadata errors	Adding mxHERO's email details to the stored file failed
Set metadata errors	Applying your metadata template failed
User storage connection errors	mxHERO couldn't connect to the storage account (for example, expired authorization)
Attachment extraction errors	Extracting the attachments failed
Email extraction errors	Creating the email or body file to upload failed

Read the email details

Click a result to open its details.

The details have four parts:

Status overview. Cards with the number of recipients in each state: delivered, queued, dropped, rejected, quarantined (held) and error.
Message details. When mxHERO received it, envelope sender, From, To, subject, Message-ID, original size, attachment names, and whether it is a TNEF (winmail.dat) message.
Email actions. Everything that happened before the email was split per recipient, grouped by rule. Open an event to see its data, or download it as JSON.
Recipients. One row per recipient with the latest status and its time. Expand a recipient to see every action for that recipient, including the final delivery: the receiving server (relay), the delay and the SMTP status. You can download the recipient's actions as JSON.

Events you may see

Event	Meaning
Mail Received	mxHERO accepted the email.
Mail Split	The email was split into one copy per recipient for processing.
Rule Executed	A rule ran on the email. The event names the rule, action and target.
Rule not applied (`eval_filter_failed`)	A rule was checked but didn't apply. The event gives the reason, for example `mail_content_without_attachments`, `flow_filter_from_to` or `rule_shortcode_avoid_processing`. See Mail Not Processed.
Rule Execution Failed	A rule failed. The original email continued and later rules still ran.
Storage Requested / Storage Executed	Files were sent to cloud storage, and the result.
Mail Quarantined / released	The email was held by Temporary Hold or Request Approval, and later released.
Mail Dropped	The email wasn't delivered on purpose (Block Attachments, rejected or canceled hold or approval, Forwarding Address).
Mail Rejected	The email was rejected, for example because storage failed on a rule set to Bounce email to sender. The sender got a `[BOUNCED]` notice.
Mail Delivered	mxHERO handed the email to its delivery service.
Delivery result	The final answer from the recipient's server: sent, deferred (will retry), bounced or expired, with relay, delay and SMTP status.
Mail Bounced	Delivery failed and the sender got a bounce.
Reprocessing	The email is being processed again, for example from Rules › Reprocess Emails.

Export logs as CSV

Use the Log Reports tab to export many emails at once, for audits or analysis in a spreadsheet.

Select the Log Reports tab.
Set the filters, as for a search.
Click Create report.
In the Select report fields window, choose the columns. Recipient and Received At are locked on and always included.
Confirm. The report appears in the table with its status.
When the status shows it is ready, click download. The file is a ZIP containing the CSV.

Reports are available for 5 days, then deleted automatically. Each report can contain up to 500,000 rows. You can cancel a report while it is still pending.

The CSV has one row per recipient, so an email sent to five people gives five rows.

Column	Contents
`recipient`	Recipient address (always included)
`receivedAt`	When mxHERO received the email (always included)
`receivedId`	Identifier of the batch in which the sending server passed the email to mxHERO (off by default)
`receivedMsgUID`	Identifier of the email (same for all its recipients) (off by default)
`recipientMsgUID`	Identifier of the email for one recipient
`action`	The latest action for the recipient
`actionCreatedAt`	When that action happened
`messageId`, `subject`, `sender`, `from`, `to`	Message details
`bytes`	Size of the email
`attachments`	Attachment file names
`isTnef`	Whether the email is a TNEF (`winmail.dat`) message
`finalStatus`	Final delivery outcome: `sent`, `bounced`, `deferred`, `expired`, `dropped`, `rejected`, `quarantined`, `bouncedInternal`, `queued` or `received`. Available for email from 26 May 2026 onward.

Tips:

To group all recipients of one email, use receivedMsgUID or messageId.
To group email one recipient got from one sender, use recipientMsgUID.

Troubleshooting

Symptom	Cause	Fix
An email you expect isn't found	It didn't reach mxHERO (routing, pilot group, or the Transport Agent header missing with Only process email rules with transport agent header on), or the filters are too narrow	Widen the dates and remove filters. Check the message headers in the recipient's mailbox. See Mail Not Processed.
"An error occurred while requesting your information, please try again later."	The date range starts more than a year ago, or the search is too broad	Set From Date within the last 12 months and add filters.
A delivery status option is disabled	From Date is before 26 May 2026	Move From Date to 26 May 2026 or later.
The email is listed, but no rule ran	The rule's senders, recipients or filters didn't match	Check the rule-not-applied reason in the email actions.
Rule Execution Failed	The rule hit an error; the original was delivered	Open the event for the error and check Reports › Notifications.
A report download doesn't start	The report expired (5 days), or the download link expired	Create the report again. Download links work only right after you click.